Design secure workloads and applications

Tamsin Outfitters is designing a VPC for a new e-commerce site that has an Application Load Balancer, a tier of EC2 application servers, and an Amazon RDS for PostgreSQL database. The company's security policy states that only components that must receive traffic from the internet may have a route to the internet gateway, and the database must not be reachable from the internet under any circumstances.

Which subnet placement meets these requirements?

1. APlace the load balancer, the application servers, and the database in public subnets and rely on security groups to block internet access to the servers and database.Placing everything in public subnets gives each component a route to the internet gateway, which the policy forbids for anything that does not need to receive internet traffic.
2. BPlace the load balancer in public subnets, and place the application servers and the database in private subnets with no route to the internet gateway.Only the load balancer must accept connections from the internet, so it alone belongs in public subnets. The application and database tiers are reachable only through the load balancer and internal security group rules.
3. CPlace the load balancer and application servers in public subnets and the database in a private subnet.The application servers receive traffic from the load balancer, not directly from the internet, so they do not need a route to the internet gateway.
4. DPlace all three tiers in private subnets and attach an Elastic IP address to the load balancer so it can be reached from the internet.An internet-facing load balancer must be deployed in public subnets; an Elastic IP address cannot be attached to an Application Load Balancer.

Marlowe Ticketing runs its web tier behind an Application Load Balancer in two public subnets. The security team has identified a single IP address, 198.51.100.77, that is repeatedly probing the site. The team wants to block all traffic from that address at the subnet level immediately, with the least effort, while continuing to accept traffic from everyone else on ports 80 and 443.

What should a solutions architect do?

1. AAdd a rule to the public subnets' network ACL with a low rule number that denies all traffic from 198.51.100.77/32.Network ACLs support explicit Deny rules and are evaluated in rule-number order, so a low-numbered Deny for the single address blocks it before the Allow rules for 80 and 443 are reached.
2. BAdd a rule to the load balancer's security group that denies all traffic from 198.51.100.77/32.Security groups contain only Allow rules; there is no way to write a Deny rule in a security group.
3. CRemove the 0.0.0.0/0 inbound rule from the load balancer's security group and add an Allow rule for every other IP range on the internet.Enumerating all permitted addresses is impractical and the security group rule limit makes it impossible for public internet traffic.
4. DCreate a route in the public subnets' route table that sends traffic for 198.51.100.77/32 to a blackhole target.Route tables govern outbound destinations, not inbound sources, and there is no blackhole target type that can be created manually.

Lindqvist Media has 400 Lambda functions that read roughly 2,000 configuration values such as feature flags, API endpoint URLs, and queue names. About 30 of the values are API keys for partner services that do not support automatic rotation. The values must be stored centrally, versioned, and retrievable by function code through the AWS SDK. The company wants to minimize cost and does not require automatic rotation.

Which solution meets these requirements MOST cost-effectively?

1. AStore all 2,000 values as secrets in AWS Secrets Manager and grant the functions secretsmanager:GetSecretValue.Secrets Manager charges per secret per month and per API call, which is unnecessary for 1,970 non-secret configuration values that need no rotation.
2. BStore the values in a DynamoDB table encrypted with a customer managed key and have each function query the table at startup.A custom table works but requires the company to build versioning and access patterns that Parameter Store already provides at no charge.
3. CStore the configuration values as standard String parameters and the 30 API keys as SecureString parameters in AWS Systems Manager Parameter Store.Standard parameters in Parameter Store are free, support versioning and hierarchical names, and SecureString parameters are encrypted with KMS, so the whole set is centralized at minimal cost with no custom code.
4. DEmbed the values in each function's environment variables and encrypt the API keys with a KMS key.Environment variables are duplicated across 400 functions, so a single change requires 400 updates, and there is no central version history.

Bellhaven Exchange runs a public trading website served through an Amazon CloudFront distribution with an Application Load Balancer origin. The company has suffered two volumetric DDoS attacks and a flood of HTTP requests against its login page from a small set of IP addresses. Bellhaven wants 24/7 access to AWS DDoS experts, protection against scaling charges caused by attacks, and an automatic block for any single client that exceeds 1,000 requests in five minutes.

Which two actions should a solutions architect take? Each correct answer presents part of the solution.

1. ASubscribe to AWS Shield Advanced and add the CloudFront distribution and the load balancer as protected resources.Shield Advanced provides enhanced DDoS mitigation, access to the Shield Response Team, and cost protection credits for scaling that results from an attack on protected resources.
2. BRely on AWS Shield Standard, which is enabled automatically on CloudFront, and open a support case during the next attack.Shield Standard protects against common network-layer attacks but does not include the response team, cost protection, or application-layer visibility the company wants.
3. CCreate an AWS WAF web ACL with a rate-based rule that blocks IP addresses exceeding 1,000 requests in a five-minute window, and associate it with the CloudFront distribution.A WAF rate-based rule counts requests per IP over a rolling window and automatically blocks sources that exceed the limit, which addresses the login-page flood at the edge.
4. DAdd a network ACL to the load balancer subnets that denies traffic from the attacking IP addresses.A static ACL deny list must be maintained by hand, does not scale to changing attacker addresses, and sits behind CloudFront where the source address is a CloudFront edge, not the client.
5. EMove the website behind AWS Global Accelerator so that attack traffic is absorbed at AWS edge locations.Global Accelerator improves routing and availability for TCP and UDP traffic and is itself protected by Shield, but it does not add expert support, cost protection, or request-rate limiting, and the site already uses CloudFront.